Part III: The machine

12. Risk

Coverage

With m = capMultiplierBps/1e4, at the cap:

coverage = 1 + 1/m

At the live 2x dial that is 1.5x: for every dollar of claim outstanding at the limit there are fifty cents of cushion behind it. At 1x it is 2.0x. The reserve-gated path is tighter, because the cash term clamps at the cushion before applying the ratio, forcing an effective 1x regardless of the dial.

All of that is arithmetic about a cash-backed market. A share-backed market does not need a cushion at all, because the thing behind the claim is the claim. That is the single change that lifts the depth ceiling, and it is why every number in this section is a statement about today rather than about the design.

The gap

The Desk's exposure is a stock that can move while nobody is trading. The cushion that absorbs it accrues from spread. Setting them equal:

turnover needed / open position = gap / spread

A 10% gap against the 10 bps an LP actually retains in hours is 100x turnover. Against the 180 bps retained after hours it is 5.6x. The gross-spread version gives 33x and is the wrong number to plan with, because 20 bps of the 30 is carved out before an LP sees it.

The structural point survives either number: the buffer scales with volume and the exposure scales with position. A token people buy and hold is the dangerous shape, and it is exactly the shape a successful meme launch produces. Section 10 is how the buffer gets funded by someone other than the protocol. Section 5 is how it stops being needed.

Measured on mainnet: a market was moved from $50.00 to $55.00 and Desk equity fell from $30.82 to $26.14. The loss was $4.6775, exactly 0.9355 shares * $5.00. The book behaved precisely as the arithmetic says.

The breaker, and the universal failure state

Breaker.sol, deployed and exercised. ownerTrip moves a market from Live to SettleOnly and ownerRestore puts it back, with no external reference needed. Both were run on a live market.

Every failure state in Float is settle-only rather than halted: a stale oracle, a thin poster set, a lost cushion, a tripped breaker, a reserve shortfall. In all of them holders can leave and nobody can enter. That is the design rule, and it is the one worth remembering because it is the one a holder cares about.

Isolation, and what is not isolated

Per-market isolation was attempted and reverted, deliberately. Isolated: each market's backing, cap, reserve, fee accruals and gate. Not isolated: the USDG balance and therefore directional P&L, which is pooled across markets through Desk equity. Booking gross spread per market while directional P&L stays pooled would let a backer harvest the good leg and leave the bad one with the LP, which is worse than the pooling it replaces. The fix is a fresh Desk, and a fresh Desk orphans every live fSHARE.